Subject: Re: The IETF Mission

From: Dean Anderson <[email-masked]>
Date: Fri, 30 Jan 2004 11:46:00 -0500 (EST)

> 
> Thinking out loud here, plenty of room for all to chime in. The key 
> differences, if there are any, between IETF and NANOG and her sisters, and 
> between IETF and IRTF, are:

Nanog should not be compared to the IETF.  Nanog is a forum that has
promoted ignorance of the law or perhaps even tolerance of illegal
activity, and specifically promotes misinformation of network operators
with respect to the Electronic Communications and Privacy Act (ECPA) and
Computer Fraud and Abuse Act (CFAA). Nanog does this by selective
suppression of discussion on the subject and the suppression of
participation of anyone who would refute the notion that the ECPA only
applies to "common carriers".  Merit and Nanog describe themselves as
"educational".  The failure to educate Network Operators on the legal
aspects of their profession is, in my opinion, nothing less than
reprehensible.  Quite obviously, there are legal aspects to internet
service operation just as there are legal aspects to business. No
reputable business school would fail to provide adequate courses in
business law, or fail to discuss the legal aspects of business with
students. Nanog claims to be an educational organization, yet it fails to
live up to any reasonable standard of education, and goes further with its
selective suppression.  The selective suppression reveals an agenda of
misinformation that goes beyond simply not educating.

Over the years, I have done extensive research on the ECPA, and the CFAA.
I have employed lawyers on the subject, and have supporting documents such
as legal, uptodate copies of the statutes, the House and Senate reports on
the ECPA and the CFAA, and the Model Criminal Code, as well as an
extensive library of case law. While the House and Senate reports on the
ECPA speak extensivly about Email and Remote Computing Services, many
people on Nanog have posted that the ECPA does not apply to ISPs. Yet
despite having all this information, Susan Harris has asked me not to
refute those people who claim that the ECPA does not apply to ISPs or
Email.

In January of 2000, Susan Harris asked me (only me) to stop posting on the
subject, in reference to a specific incident.  She didn't want me to
refute people on the topic. She did not make any requests of anyone else
to stop, and the "bashing" continued for two or three days, until news
reported that law enforcement acted in a way that vindicated what I was
saying. After I posted this vindication, which came after several days of
bashing in which I did not participate, she removed my posting privileges.  
Actually being right on concrete issues is not something that is respected
on Nanog. My posts were also informative, respectful, and well supported
with citations.  Supposing this were off-topic, it would be appropriate to
ask everyone to stop. But of course, it isn't any more off-topic for
Network operators to learn about the ECPA than it is for business school
candidates to learn about business law.

While Nanog did have a DOJ person speak in October, 2000, that
presentation has been wildly misquoted, and it barely addressed the civil
aspect of the ECPA.  The CFAA was not discussed.  False information is
still posted on Nanog on the topic, which has been brought up by others.
And the topic is clearly of interest to network operators, because it
keeps coming up.  

For example, I was not allowed to correct claims made in June 2002 by
Steve Bellovin that "what you say is correct for *telephone* companies,
but not ISPs.".  Bellovin attributes this statement to the DOJ
presentation. But the DOJ presentation does not in fact say that. Though I
concede that it is easy to take the slides out of context, this goes well
beyond that.  Bellovin makes other mistakes to give the impression that
only common carriers need be concerned with the ECPA.  Bellovin also uses
claims of "discussions with prosecutors" to substantiate his claims. But
his claims are refuted by the statute text, the Congressional Reports, and
the case law.  Unfortunately, few are familar with that material allowed
to post.  Some of the material is obscure and costs money to obtain. So I
am limited to privately emailing information to the people who posted the
original questions.  Others, perhaps interested in the topic, but who
didn't post, are misled.

So Nanog is quite a bit different from the IETF, and, in my opinion,
should not be associated with or compared to the IETF.  Actually being 
right on concrete issues is something that carries no weight with Nanog, 
but it does carry weight with the IETF.

Dean Anderson
CEO
Av8 Internet, Inc

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Fri, 30 Jan 2004 11:59:33 -0800

Dean,

the subject of the IETF mission is not particularly relevant to bashing 
NANOG policies, or personal attacks on persons for their activities within 
NANOG.
Nor are personal attacks appropriate on the IETF list.
If you want to quarrel about NANOG topics, at least change the subject.
Or better yet, take it to NANOG.

---

From: Dean Anderson <[email-masked]>
Date: Fri, 30 Jan 2004 18:01:54 -0500 (EST)

Harald,

It seems that you haven't quite followed the thread, or read the messages.

This issue was brought up in a comparison between Nanog and the IETF by
Fred Baker, who apparently found little difference between the IETF and
Nanog.  It is quite valid to make comparisions to the missions of other
organizations, so he brings up a valid point, which deserves equally valid
disagreement.

The events involving Susan Harris occurred, and I am reporting them to
distinguish the IETF from Nanog in response to a post comparing the IETF
to NANOG. Many people no doubt think her conduct was improper.  Reporting
improper conduct is not a personal attack.  The act I am criticizing was
made in her official role at Nanog, and reflects on Nanog as an
organization. This was not a private or personal act.  It has nothing to
do with her personally except that she is a person responsible for Nanog,
and has authority at Nanog, and she made the decsisions which are being
criticized.  Her official decisions reflect on Nanog just as your official
decisions reflect on the IETF.  If you make bad decisions, they will
reflect badly on the IETF, and you and the IETF will deserve criticism.  
Such criticism is not a personal attack. You are misusing the term.

Susan Harris may be an nice person. I've never met her in person. I don't
know anything personal about her to attack.  But sometimes nice people
behave in ways that are quite obviously improper. Documenting, reporting,
criticizing, and complaining about such behavior is not a personal attack.
For your information and reference, a 'personal attack' is where one
attacks a personal trait of the person, rather than their position.  I've
attacked her position as represented by her official decisions regarding
Nanog, not her personally.

Sometimes people try to deflect criticism by trying to call it a personal
attack. This in not the first time that people have misused the term
'personal attack' when their friends were being criticized.  Perhaps you
are letting your friendship get in the way?

Quite obviously, I can't take it to Nanog--apparently you didn't read my
message.  Certainly you wouldn't make such a frivolous statement if you
had read it.  But your suggestion clarifies and obvious difference between
Nanog and the IETF: there is no one in authority other than Susan
Harris--there is no one to appeal her decisions to.  IETF decisions, as
you know, can be appealed.

But she also did some things that are relevant to the IETF.  Besides
halting my participation in Nanog, she also halted my participation in the
RADB. At the time, Av8 was participating in the RADB and had RADB objects.  
It seems to me that denying my participation in the RADB may be a
violation of IETF/ISOC/ICANN rules.  And this should be redressed.

Thanks,

Dean Anderson
CEO
Av8 Internet, Inc

---

From: Joe Abley <[email-masked]>
Date: Fri, 30 Jan 2004 19:38:04 -0500

On a purely operational note, and ignoring (having not read) the other 
aspects of this thread:

On 30 Jan 2004, at 18:01, Dean Anderson wrote:

> violation of IETF/ISOC/ICANN rules.

Merit operates the RADB, which is one of many loosely-associated public 
databases known as the Internet Routing Registry (IRR), each modelled 
(sometimes slightly loosely, with respect to local extensions) on 
RFC2622, "Routing Policy Specification Language (RPSL)". The RADB is a 
for-fee service run by Merit of their own volition.

An example list of alternative, independently-operated databases within 
this vague "IRR" umbrella can be found by looking through the mirrored 
databases at:

   ftp://ftp.merit.edu/radb/dbase/

Each of those comes from a different database. All the databases are, 
in general, run independently.

There is nothing magical and special about the RADB in the context of 
the operation of the IRR, and if Merit does not want you as a customer 
there are plenty of other suppliers you can talk to. Perhaps start 
here: <http://www.altdb.net/>.

Joe